Send SNMP trap to other systems

[mznikkip]

I've read the documentation on how to send SNMP traps to other systems, however, I'm confused. How does traphosts.pl know to run sendsnmptrap.pl? I have the IP addresses for my trap receivers but not sure which parameters to change in sendsnmptrap.pl.

[briang67 · Accepted solution]

In the sendsnmptrap.pl you'll want to change the $hostPortSNMP wiith the IP and port of your trap receiver.

[mznikkip]

Ahhh got it. I did a yum install for net-snmp-utils and now it seems to be working. Thanks for your help through this matter!

[briang67]

The snmptrap binary is in a separate rpm: net-snmp-utils.

[mznikkip]

Ok done and done. Sorry for all the questions! I installed Net-SNMP but snmptrap does not appear in /usr/bin. In the directory where I did install it, I still don't even see /bin directory or 'snmptrap'.

[briang67]

One way to test would be to just run a tcpdump or snoop on the receiving host to see if the trap was received.

[briang67]

You can set a second variable like #hostPortSNMP2 and just run the $cmd a second time substituting the new variable

[mznikkip]

Is there a way to send to two different trap receivers? Or would I have to create another sendsnmptrap.pl?
Also, how do I test to make sure it's working?

[briang67]

We use the trap script extensively at my company for alerting purposes. With our setup we call a shell script from the saved search called sendtrap.sh - that calls a customized version of the perl script sendsnmptrap.pl. The script passes the parameters needed for the perl script.

The shell script looks like this:

 #!/bin/sh
cd /opt/splunk/bin/scripts
$(./sendtrapv15.pl "$1" "$2" "$3" "$4" "$5" "$6" "$7" "$8")